@cello-protocol/daemon 0.0.227 → 0.0.228

package/dist/away-detection.d.ts

@@ -0,0 +1,139 @@
+/**
+ * DOD-AWAY-MUTUAL-SEAL-1 — recognising this daemon's own away auto-replies.
+ *
+ * ── WHY THIS EXISTS ──────────────────────────────────────────────────────────────────────────────
+ *
+ * When two agents contact each other while BOTH are unattended, each side's away responder answers
+ * the other's away responder. The second such arrival looks exactly like "a caller who ignored the
+ * leave-a-message instruction", which is what `DOD-INBOX-ONESHOT-1` exists to handle — so both sides
+ * send a `[[WRAP]]` rejection and initiate a seal. Two distinct-sender SEAL ctrl leaves is precisely
+ * what triggers notarization.
+ *
+ * Measured on the relay's own log 2026-08-09: a session **sealed three seconds after it opened**,
+ * its entire content being two machines telling each other nobody was home. Neither daemon learned
+ * (the seal completion is pushed with no pull twin), so both kept showing `active`; the operators
+ * came back, talked into a closed room for 68 minutes, and found out only at close.
+ *
+ * The one-shot rule is right about a human who keeps typing. It is wrong about another away
+ * responder, which is not a caller ignoring anything.
+ *
+ * ── DOD-M12B-AWAY-MARK-1 (2026-08-17): A MARKER, PLUS THE EXACT MATCHING ────────────────────────
+ *
+ * This file used to argue against a marker, on the grounds that it is a WIRE change an older peer
+ * would not send. That argument holds for a marker in the wire FRAME, and `AWAY_AUTO_REPLY_MARKER`
+ * is not one — it is a token at the front of the message TEXT, the same class of thing as
+ * `[[OVER]]` and `[[WRAP]]`, which already ride in the body and which the receive path already
+ * parses. An older peer just sends text without it. So the exact matching below did not go away; it
+ * became the LEGACY branch, and it is still the only thing that recognises an un-upgraded peer.
+ *
+ * The marker exists because of a defect the mutual-seal fix does not touch. This daemon's away
+ * responder answers when nobody is attending, and the reply goes out as an ordinary `msg` leaf at a
+ * real sequence with nothing on it to say a machine wrote it. To the initiator that is positive
+ * evidence a person is there. Measured 2026-08-17: two agents spent a morning exchanging each
+ * other's away responders while both operators believed a conversation was happening.
+ *
+ * PREFIX, never suffix. `[[WRAP]]` detection is end-anchored on purpose (`DOD-WRAP-SUBSTRING-1`)
+ * and the one-shot rejection ends with `[[WRAP]]`; a marker appended at the end would take that
+ * position and silently break the counterparty's close detection.
+ *
+ * The marker LABELS, it never SUPPRESSES. An in-band token is spoofable — a human can type it — so
+ * it must never be able to make a real message vanish. It changes what the reader is told, never
+ * whether the reader is told.
+ *
+ * ── WHY EXACT MATCHING IS STILL HERE ────────────────────────────────────────────────────────────
+ *
+ * EXACT, never substring. A human who quotes the away message must still be answered; silencing a
+ * real message is a worse failure than the one being fixed, because the operator would never learn
+ * it arrived.
+ *
+ * The texts live HERE and are read by both the sender and the detector. A second hardcoded copy is
+ * how a reworded away message stops being recognised and the loop quietly returns.
+ *
+ * ── WHY A CUSTOM AWAY MESSAGE ON THE FAR SIDE DOES NOT DEFEAT THIS ───────────────────────────────
+ *
+ * An operator can set their own away wording (`resolveAwayMessage`). Against a marker-aware peer
+ * that is now solved outright — the marker is applied at the single send choke point in
+ * `sendAwayResponse`, so a configured message carries it exactly like a default one does, and this
+ * is the gap exact matching could not close by construction.
+ *
+ * Against an un-upgraded peer with custom wording, the original reasoning still applies and is
+ * unchanged: **notarization requires TWO ctrl leaves from DISTINCT senders.** Declining on one side
+ * is enough to break it: their one-shot posts one ctrl leaf, ours does not post the second, and no
+ * certificate is minted. The session simply stays unsealed, which is the correct end for an
+ * exchange nobody had.
+ *
+ * A broader rule was tried and reverted: "never notarize a session on which this agent has only sent
+ * away traffic". It disabled `DOD-INBOX-ONESHOT-1`'s designed behaviour — a REAL caller who ignores
+ * the leave-one-message instruction should still get the inbox closed on them — and five tests
+ * correctly caught it. The narrow rule is not a weaker version of the broad one; it is the correct
+ * one, because the thing to suppress is a machine answering a machine, not an away agent sealing.
+ */
+/**
+ * The in-band mark on every message this daemon generates without a human in the loop.
+ *
+ * DOD-M12B-AWAY-MARK-1. Prefixed, for the end-anchoring reason in the header. Deliberately shaped
+ * like the existing `[[…]]` signal tokens: the receive path already parses that family, an older
+ * peer reads it as plain text rather than choking, and a human reading the transcript can see it.
+ */
+export declare const AWAY_AUTO_REPLY_MARKER = "[[AUTO-REPLY]]";
+/**
+ * Prefix `text` with the auto-reply marker. IDEMPOTENT — the single send choke point in
+ * `sendAwayResponse` marks whatever `resolveAwayMessage` returns, which for a system default is
+ * already marked, and double-marking would put a stray token in front of every operator's greeting.
+ */
+export declare function markAsAutoReply(text: string): string;
+/**
+ * True when `text` carries the marker AT THE FRONT.
+ *
+ * Anchored, not a substring search: a message that merely mentions the marker is a person talking
+ * about it, and labelling that as machine traffic teaches the reader to discount a human.
+ */
+export declare function isAutoReplyMarked(text: string): boolean;
+/** The exact strings this daemon sends as away auto-replies. Marked at the source. */
+export declare const AWAY_AUTO_REPLY_TEXTS: {
+    /** The session-offer answer, which names the away agent — so it is built, not fixed. */
+    readonly offerFor: (agentName: string) => string;
+    /**
+     * M8C-CONTACT-1: "unknown senders learn only 'dispatched' by default" — deliberately minimal.
+     *
+     * It stays bare after DOD-M15-AWAYSCOPE-1. Andre's principle 3 draws the line at ACCEPTED
+     * sessions: a counterparty who accepted is entitled to know what happened to the session, and a
+     * STRANGER knocking is not. Lives here beside its siblings for the reason the marker does: one
+     * definition, so a reword cannot desynchronise the detector.
+     */
+    readonly stranger: "[[AUTO-REPLY]] Dispatched.";
+};
+/**
+ * The system default away text for an inbound session REQUEST, per whether the caller is known.
+ * MOVED HERE from `attendance-wiring.ts` (DOD-M15-AWAYLEAF-1) so the selection sits beside the
+ * strings it selects.
+ *
+ * The record that travelled with it:
+ * - DOD-AWAY-WRAP-1 AC1: the request text is a leave-a-message greeting, and it names the specific
+ *   away agent — which is why it is built rather than fixed.
+ * - ONE definition, shared with the detector in this file. A second copy elsewhere is how a reworded
+ *   away message stops being recognised as machine traffic and the mutual-seal loop
+ *   (DOD-AWAY-MUTUAL-SEAL-1) quietly comes back.
+ *
+ * ⚠️ DOD-M15-AWAYSCOPE-1 TOOK THE SECOND KIND AWAY, and with it the reason this function took a
+ * `kind` at all. There used to be a second arm for a message arriving on an ALREADY-ACCEPTED
+ * session — the one-shot acknowledgement, `DOD-AWAY-ACK-ONESHOT-TEXT-1` — and sending it was the
+ * defect: it typed a status announcement into a live conversation and took a chain leaf doing it.
+ * Its wording survives below as `ONESHOT_BODY`, unsent, because the legacy branch of
+ * `isOwnAwayAutoReply` is the only thing that still recognises an un-upgraded peer sending it.
+ */
+export declare function systemAwayText(agentName: string, isKnown: boolean): string;
+/**
+ * True when `text` is away auto-reply traffic — a machine, not a caller.
+ *
+ * The caller must neither answer it nor count it toward the one-shot rule. Answering produces the
+ * ping-pong; counting it produces the seal.
+ *
+ * Two branches, and both are needed. The MARKER branch covers any marker-aware peer including one
+ * running a configured away message, which exact matching could never reach. The LEGACY branch
+ * covers a peer on the pre-marker build sending this daemon's old default wording — remove it and
+ * two away agents on mixed versions notarize a session nobody had, which is the whole of
+ * DOD-AWAY-MUTUAL-SEAL-1.
+ */
+export declare function isOwnAwayAutoReply(text: string): boolean;
+//# sourceMappingURL=away-detection.d.ts.map

package/dist/away-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"away-detection.d.ts","sourceRoot":"","sources":["../src/away-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AA4BvD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED,sFAAsF;AACtF,eAAO,MAAM,qBAAqB;IAChC,wFAAwF;mCACpE,MAAM,KAAG,MAAM;IAInC;;;;;;;OAOG;;CAEK,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CAG1E;AAGD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQxD"}

package/dist/away-detection.js

@@ -0,0 +1,186 @@
+/**
+ * DOD-AWAY-MUTUAL-SEAL-1 — recognising this daemon's own away auto-replies.
+ *
+ * ── WHY THIS EXISTS ──────────────────────────────────────────────────────────────────────────────
+ *
+ * When two agents contact each other while BOTH are unattended, each side's away responder answers
+ * the other's away responder. The second such arrival looks exactly like "a caller who ignored the
+ * leave-a-message instruction", which is what `DOD-INBOX-ONESHOT-1` exists to handle — so both sides
+ * send a `[[WRAP]]` rejection and initiate a seal. Two distinct-sender SEAL ctrl leaves is precisely
+ * what triggers notarization.
+ *
+ * Measured on the relay's own log 2026-08-09: a session **sealed three seconds after it opened**,
+ * its entire content being two machines telling each other nobody was home. Neither daemon learned
+ * (the seal completion is pushed with no pull twin), so both kept showing `active`; the operators
+ * came back, talked into a closed room for 68 minutes, and found out only at close.
+ *
+ * The one-shot rule is right about a human who keeps typing. It is wrong about another away
+ * responder, which is not a caller ignoring anything.
+ *
+ * ── DOD-M12B-AWAY-MARK-1 (2026-08-17): A MARKER, PLUS THE EXACT MATCHING ────────────────────────
+ *
+ * This file used to argue against a marker, on the grounds that it is a WIRE change an older peer
+ * would not send. That argument holds for a marker in the wire FRAME, and `AWAY_AUTO_REPLY_MARKER`
+ * is not one — it is a token at the front of the message TEXT, the same class of thing as
+ * `[[OVER]]` and `[[WRAP]]`, which already ride in the body and which the receive path already
+ * parses. An older peer just sends text without it. So the exact matching below did not go away; it
+ * became the LEGACY branch, and it is still the only thing that recognises an un-upgraded peer.
+ *
+ * The marker exists because of a defect the mutual-seal fix does not touch. This daemon's away
+ * responder answers when nobody is attending, and the reply goes out as an ordinary `msg` leaf at a
+ * real sequence with nothing on it to say a machine wrote it. To the initiator that is positive
+ * evidence a person is there. Measured 2026-08-17: two agents spent a morning exchanging each
+ * other's away responders while both operators believed a conversation was happening.
+ *
+ * PREFIX, never suffix. `[[WRAP]]` detection is end-anchored on purpose (`DOD-WRAP-SUBSTRING-1`)
+ * and the one-shot rejection ends with `[[WRAP]]`; a marker appended at the end would take that
+ * position and silently break the counterparty's close detection.
+ *
+ * The marker LABELS, it never SUPPRESSES. An in-band token is spoofable — a human can type it — so
+ * it must never be able to make a real message vanish. It changes what the reader is told, never
+ * whether the reader is told.
+ *
+ * ── WHY EXACT MATCHING IS STILL HERE ────────────────────────────────────────────────────────────
+ *
+ * EXACT, never substring. A human who quotes the away message must still be answered; silencing a
+ * real message is a worse failure than the one being fixed, because the operator would never learn
+ * it arrived.
+ *
+ * The texts live HERE and are read by both the sender and the detector. A second hardcoded copy is
+ * how a reworded away message stops being recognised and the loop quietly returns.
+ *
+ * ── WHY A CUSTOM AWAY MESSAGE ON THE FAR SIDE DOES NOT DEFEAT THIS ───────────────────────────────
+ *
+ * An operator can set their own away wording (`resolveAwayMessage`). Against a marker-aware peer
+ * that is now solved outright — the marker is applied at the single send choke point in
+ * `sendAwayResponse`, so a configured message carries it exactly like a default one does, and this
+ * is the gap exact matching could not close by construction.
+ *
+ * Against an un-upgraded peer with custom wording, the original reasoning still applies and is
+ * unchanged: **notarization requires TWO ctrl leaves from DISTINCT senders.** Declining on one side
+ * is enough to break it: their one-shot posts one ctrl leaf, ours does not post the second, and no
+ * certificate is minted. The session simply stays unsealed, which is the correct end for an
+ * exchange nobody had.
+ *
+ * A broader rule was tried and reverted: "never notarize a session on which this agent has only sent
+ * away traffic". It disabled `DOD-INBOX-ONESHOT-1`'s designed behaviour — a REAL caller who ignores
+ * the leave-one-message instruction should still get the inbox closed on them — and five tests
+ * correctly caught it. The narrow rule is not a weaker version of the broad one; it is the correct
+ * one, because the thing to suppress is a machine answering a machine, not an away agent sealing.
+ */
+/**
+ * The in-band mark on every message this daemon generates without a human in the loop.
+ *
+ * DOD-M12B-AWAY-MARK-1. Prefixed, for the end-anchoring reason in the header. Deliberately shaped
+ * like the existing `[[…]]` signal tokens: the receive path already parses that family, an older
+ * peer reads it as plain text rather than choking, and a human reading the transcript can see it.
+ */
+export const AWAY_AUTO_REPLY_MARKER = "[[AUTO-REPLY]]";
+/**
+ * The unmarked bodies. Kept separate so the legacy detector below matches an un-upgraded peer.
+ *
+ * ⚠️ `ONESHOT_BODY` IS NO LONGER SENT — `away-inbox-oneshot.ts` sends its own line — but it IS read
+ * again. DOD-M15-AWAYSCOPE-1 deleted the branch that sent it and the only production call site of
+ * `isOwnAwayAutoReply` along with it; DOD-INBOX-ONESHOT-1 gave that recogniser a caller again,
+ * because a file that can SEAL must recognise an un-upgraded peer's away traffic, not just a
+ * marker-aware one. An earlier version of this comment said the legacy recogniser "is what stops this
+ * side treating that machine traffic as a person" — review caught that, and it is false: the only
+ * live recogniser is `isAutoReplyMarked`, which matches the MARKER and therefore does NOT match an
+ * un-upgraded peer's unmarked body.
+ *
+ * So an old peer's one-shot now arrives unlabelled. That is a real, small loss and it is stated
+ * rather than papered over: the operator sees the text, which names itself as an away reply in
+ * plain English, and nothing acts on the classification any more because nothing replies.
+ *
+ * Both are RETAINED, not dead-code-cleaned, because the order forbids touching this guard while the
+ * attendance work is unfinished — a call site may return. Retained-pending-a-caller, said out loud.
+ */
+const ONESHOT_BODY = "Agent is currently away. Your message has been received and will be read when the operator returns. " +
+    "This inbox accepts one message per visit — please close the session now (send with signal: wrap) instead of sending more.";
+/** The offer text with the agent name removed, so any agent's offer is recognised. */
+const OFFER_SUFFIX = " is currently away. Leave a message (send with signal: wrap to close) and it will be read when they return.";
+/**
+ * Prefix `text` with the auto-reply marker. IDEMPOTENT — the single send choke point in
+ * `sendAwayResponse` marks whatever `resolveAwayMessage` returns, which for a system default is
+ * already marked, and double-marking would put a stray token in front of every operator's greeting.
+ */
+export function markAsAutoReply(text) {
+    if (isAutoReplyMarked(text))
+        return text;
+    return `${AWAY_AUTO_REPLY_MARKER} ${text}`;
+}
+/**
+ * True when `text` carries the marker AT THE FRONT.
+ *
+ * Anchored, not a substring search: a message that merely mentions the marker is a person talking
+ * about it, and labelling that as machine traffic teaches the reader to discount a human.
+ */
+export function isAutoReplyMarked(text) {
+    return text.startsWith(AWAY_AUTO_REPLY_MARKER);
+}
+/** The exact strings this daemon sends as away auto-replies. Marked at the source. */
+export const AWAY_AUTO_REPLY_TEXTS = {
+    /** The session-offer answer, which names the away agent — so it is built, not fixed. */
+    offerFor(agentName) {
+        return `${AWAY_AUTO_REPLY_MARKER} ${agentName}${OFFER_SUFFIX}`;
+    },
+    /**
+     * M8C-CONTACT-1: "unknown senders learn only 'dispatched' by default" — deliberately minimal.
+     *
+     * It stays bare after DOD-M15-AWAYSCOPE-1. Andre's principle 3 draws the line at ACCEPTED
+     * sessions: a counterparty who accepted is entitled to know what happened to the session, and a
+     * STRANGER knocking is not. Lives here beside its siblings for the reason the marker does: one
+     * definition, so a reword cannot desynchronise the detector.
+     */
+    stranger: `${AWAY_AUTO_REPLY_MARKER} Dispatched.`,
+};
+/**
+ * The system default away text for an inbound session REQUEST, per whether the caller is known.
+ * MOVED HERE from `attendance-wiring.ts` (DOD-M15-AWAYLEAF-1) so the selection sits beside the
+ * strings it selects.
+ *
+ * The record that travelled with it:
+ * - DOD-AWAY-WRAP-1 AC1: the request text is a leave-a-message greeting, and it names the specific
+ *   away agent — which is why it is built rather than fixed.
+ * - ONE definition, shared with the detector in this file. A second copy elsewhere is how a reworded
+ *   away message stops being recognised as machine traffic and the mutual-seal loop
+ *   (DOD-AWAY-MUTUAL-SEAL-1) quietly comes back.
+ *
+ * ⚠️ DOD-M15-AWAYSCOPE-1 TOOK THE SECOND KIND AWAY, and with it the reason this function took a
+ * `kind` at all. There used to be a second arm for a message arriving on an ALREADY-ACCEPTED
+ * session — the one-shot acknowledgement, `DOD-AWAY-ACK-ONESHOT-TEXT-1` — and sending it was the
+ * defect: it typed a status announcement into a live conversation and took a chain leaf doing it.
+ * Its wording survives below as `ONESHOT_BODY`, unsent, because the legacy branch of
+ * `isOwnAwayAutoReply` is the only thing that still recognises an un-upgraded peer sending it.
+ */
+export function systemAwayText(agentName, isKnown) {
+    if (!isKnown)
+        return AWAY_AUTO_REPLY_TEXTS.stranger;
+    return AWAY_AUTO_REPLY_TEXTS.offerFor(agentName);
+}
+/**
+ * True when `text` is away auto-reply traffic — a machine, not a caller.
+ *
+ * The caller must neither answer it nor count it toward the one-shot rule. Answering produces the
+ * ping-pong; counting it produces the seal.
+ *
+ * Two branches, and both are needed. The MARKER branch covers any marker-aware peer including one
+ * running a configured away message, which exact matching could never reach. The LEGACY branch
+ * covers a peer on the pre-marker build sending this daemon's old default wording — remove it and
+ * two away agents on mixed versions notarize a session nobody had, which is the whole of
+ * DOD-AWAY-MUTUAL-SEAL-1.
+ */
+export function isOwnAwayAutoReply(text) {
+    if (text.length === 0)
+        return false;
+    if (isAutoReplyMarked(text))
+        return true;
+    if (text === ONESHOT_BODY)
+        return true;
+    // The offer names an agent, so match the invariant tail — but require a non-empty name in front
+    // of it, so a bare quote of the suffix alone is not treated as machine traffic.
+    if (text.endsWith(OFFER_SUFFIX) && text.length > OFFER_SUFFIX.length)
+        return true;
+    return false;
+}
+//# sourceMappingURL=away-detection.js.map

package/dist/away-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"away-detection.js","sourceRoot":"","sources":["../src/away-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,YAAY,GAChB,sGAAsG;IACtG,2HAA2H,CAAC;AAE9H,sFAAsF;AACtF,MAAM,YAAY,GAAG,6GAA6G,CAAC;AAEnI;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,GAAG,sBAAsB,IAAI,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,wFAAwF;IACxF,QAAQ,CAAC,SAAiB;QACxB,OAAO,GAAG,sBAAsB,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;IACjE,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,EAAE,GAAG,sBAAsB,cAAc;CACzC,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,OAAgB;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,qBAAqB,CAAC,QAAQ,CAAC;IACpD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACnD,CAAC;AAGD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,iBAAiB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACvC,gGAAgG;IAChG,gFAAgF;IAChF,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/away-inbox-oneshot.d.ts

@@ -0,0 +1,40 @@
+import type { KeyProvider } from "@cello-protocol/crypto";
+import type { Logger, SessionRecord } from "./types.js";
+import type { SessionNodeManager } from "./session-node-manager.js";
+import type { ActiveSealResult } from "./seal-flows.js";
+import type { SealCompletion, UnilateralResult } from "./seal-coordinator.js";
+import type { SendClaims } from "./send-claims.js";
+export interface AwayInboxOneshotDeps {
+    logger: Logger;
+    sessionNodeManager: SessionNodeManager;
+    /**
+     * Sends on the wire right now — the half `weSpoke` cannot see.
+     *
+     * An outbound transcript row is written AFTER the send resolves, so for the whole round trip of
+     * an operator's reply there is a human speaking and no record of it. Reading `weSpoke` in that
+     * window answers "nobody spoke here" about a live conversation, and this path is terminal.
+     */
+    sendClaims: SendClaims;
+    /**
+     * The away wiring's own guard set, shared rather than copied: this file must fire only for a
+     * session that was ACTUALLY told "one message per visit", and that set is what records it. It
+     * also carries our own once-only key, so re-attending an agent re-arms both together (the
+     * `${name}:` sweep in agent-handlers.ts clears them as one).
+     */
+    awayAckSent: Set<string>;
+    keyProviders: Map<string, KeyProvider>;
+    /** The seal machinery this hands off to once the conversation is closed. */
+    sealKey: (agentName: string, sessionId: string) => string;
+    sealInterruptedInProgress: Set<string>;
+    pendingSealWaiters: Map<string, (completion: SealCompletion) => void>;
+    pendingUnilateralWaiters: Map<string, (r: UnilateralResult) => void>;
+    sendOver: (agentName: string, frame: Record<string, unknown>) => Promise<{
+        ok: boolean;
+        reason?: string;
+    }>;
+    handleActiveSealFlow: (sessionId: string, record: SessionRecord, correlationId: string) => Promise<ActiveSealResult>;
+}
+export declare function createAwayInboxOneshot(deps: AwayInboxOneshotDeps): {
+    closeInboxIfIgnored: (agentName: string, sessionId: string) => Promise<void>;
+};
+//# sourceMappingURL=away-inbox-oneshot.d.ts.map

package/dist/away-inbox-oneshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"away-inbox-oneshot.d.ts","sourceRoot":"","sources":["../src/away-inbox-oneshot.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAK9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKnD,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,kBAAkB,CAAC;IACvC;;;;;;OAMG;IACH,UAAU,EAAE,UAAU,CAAC;IACvB;;;;;OAKG;IACH,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,4EAA4E;IAC5E,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D,yBAAyB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,KAAK,IAAI,CAAC,CAAC;IACtE,wBAAwB,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC,CAAC;IACrE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3G,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACtH;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG;IAClE,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9E,CAkQA"}